Earlier today, I let Skycure founder Yair Amit remotely seize control of my iPhone to prove a point. It worked. The scariest part was that it didn't require my device to jailbroken, I just had to be convinced to tap a few buttons.

Configured For Attack The attack Amit used on my device has been covered already on his company's blog, but that didn't make it any less unnerving. It started with a large, friendly button on a website. I tapped it, the view immediately jumped to the iPhone's Settings application where I was prompted to install a new configuration profile.

I'll pause right here to say that config profiles are useful for changing VPN settings, email settings, and so on for a large number of devices.That said, there's probably no need for the average user to install one. Though I was complicit in the installation, Amit pointed out that most users could be convinced to do the same with a little social engineering; perhaps by offering free video streaming or free Wi-Fi.

Once installed, Amit could see everything I typed on his screen. He could also force my web browser to visit different websites (in this case, the relatively benign Bing). Then, he politely asked if he could access the Facebook app on my phone. I said yes and, unbidden, the app launched on my screen. The next part was really scary: Amit was then able to login to Facebook in a browser, on his computer as me.

Amit said that if he were an attacker, he could now learn a lot about me and even impersonate me. Gaining access to social media and email is a critical step for attackers to spread malware or initiate scams because people inherently trust these systems.

He said that in some ways, the same was true for iOS. Referring to Apple's walled garden approach, Amit said, "in this case, perfection is bad for security because people trust everything they're doing." Most people, he argued, probably wouldn't think twice about installing a config profile because they trust their iOS devices so much.

I asked him if he'd seen this kind of attack in the wild. "We see it happening," he said, calling it the worst problem facing iOS device today.

Skycure's Solution Before he completely scared the pants off me, Amit explained what the new software from Skycure actually does to keep you safe. On Android, most security applications simply scan apps to check for malware. Skycure, on the other hand, keeps tabs on network traffic, looking for potentially malicious communications.

There's a whole business IT end to their service, but the most interesting part is on the phone. Instead of watching your actual network traffic, they use a "honey pot" approach which mimics the traffic of applications like Mail. If it detects anything untoward, it secures your communications with VPN—or other remediation tactics. And, thankfully, it can remove nasty config profiles.

Amit explained that their dynamic approach means that your Internet connection won't always be throttled by VPN, and your battery won't be unnecessarily taxed either. Also, it lets your communications stay private by mimicking network traffic, instead of monitoring it. They also crowdsourced data on attacks, so that they could identify infected networks or geographic areas (like airports) that attackers frequently use.

Skycure is targeted at businesses, which means I won't be reviewing it any time soon. But it sounds like a remarkably smart way to lock down threats on the iOS platform. Hopefully we'll be seeing this kind of protection come down to the consumer level.

Stay Safe If you're worried that you might have installed a config profile in the past (I was surprised to find one that I couldn't identify), it's easy to check. Open the Settings app, tap General, and then scroll all the way down. At the bottom you should see a block of three options above Reset: iTunes Wi-Fi Sync, VPN, and Profile.

Don't see Profile? Great news: you don't have any configuration profiles installed on your device. If you do see the page, open it up and try to remember what these are for. If any of them seem suspicious, you can easily delete them by tapping the big red Remove button.

Of course, the best way to avoid this attack is to simply not install configuration profiles from anyone you don't really trust. Or at all. If you ever see a website asking to install one on your device, don't do it!

Max Eddy is a Software Analyst, taking a critical eye to Android apps and security services. He's also PCMag's foremost authority on weather stations and digital scrapbooking software. When not polishing his tinfoil hat or plumbing the depths of the Dark Web, he can be found working to discern the 100 Best Android Apps.
Prior to PCMag, Max wrote for the International Digital Times, The International Science Times, and The Mary Sue. He has also been known to write for Geek.com. You can follow him on...
More »